@lightdash/cli 2.599.0 → 2.600.0

package/dist/handlers/apps/previewProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"previewProxy.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/previewProxy.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AA6CtE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AAyBF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,SAAU;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACjB,KAAG,OAAO,CAAC,kBAAkB,CAsH7B,CAAC"}
+{"version":3,"file":"previewProxy.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/previewProxy.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AA6CtE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AAyCF;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,SAAU;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACjB,KAAG,OAAO,CAAC,kBAAkB,CAsM7B,CAAC"}

package/dist/handlers/apps/previewProxy.js

@@ -49,6 +49,20 @@ const sendJsonError = (res, status, message) => {
     res.writeHead(status, { 'content-type': 'application/json' });
     res.end(JSON.stringify({ status: 'error', results: null, message }));
 };
+const readBody = (req) => new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+    req.on('error', reject);
+});
+const parseJson = (text) => {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+};
 const secretsMatch = (actual, expected) => {
     if (typeof actual !== 'string')
         return false;
@@ -68,6 +82,50 @@ const startPreviewProxy = (args) => {
     (0, credentials_1.refuseAgentConnection)();
     const upstream = new URL(args.upstreamUrl);
     const requestFn = upstream.protocol === 'https:' ? https.request : http.request;
+    const withUpstreamCredentials = (headers) => ({
+        ...headers,
+        authorization: args.authorization,
+        ...(args.proxyAuthorization
+            ? { 'proxy-authorization': args.proxyAuthorization }
+            : {}),
+    });
+    // Resolves the parsed body of a successful upstream GET, or null.
+    const getUpstreamJson = (path) => new Promise((resolve) => {
+        const upstreamReq = requestFn({
+            protocol: upstream.protocol,
+            hostname: upstream.hostname,
+            port: upstream.port || undefined,
+            path,
+            method: 'GET',
+            headers: withUpstreamCredentials({
+                accept: 'application/json',
+            }),
+        }, (upstreamRes) => {
+            readBody(upstreamRes).then((text) => {
+                const status = upstreamRes.statusCode ?? 502;
+                resolve(status >= 200 && status < 300
+                    ? parseJson(text)
+                    : null);
+            }, () => resolve(null));
+        });
+        upstreamReq.on('error', () => resolve(null));
+        upstreamReq.end();
+    });
+    // Host-answered virtual route: replies with only the explore's base
+    // table, never the explore itself.
+    const answerExploreBaseTable = async (req, res) => {
+        const request = (0, common_1.parseAppSdkExploreBaseTableRequest)(parseJson(await readBody(req)));
+        if (request === null) {
+            sendJsonError(res, 400, 'Preview proxy: invalid explore base-table request');
+            return;
+        }
+        const explore = await getUpstreamJson(`/api/v1/projects/${encodeURIComponent(args.projectUuid)}/explores/${encodeURIComponent(request.exploreName)}`);
+        const results = {
+            baseTable: (0, common_1.extractExploreBaseTable)(explore),
+        };
+        res.writeHead(200, { 'content-type': 'application/json' });
+        res.end(JSON.stringify({ status: 'ok', results }));
+    };
     const server = http.createServer((req, res) => {
         const method = req.method ?? 'GET';
         const nonceHeader = req.headers[exports.PREVIEW_PROXY_NONCE_HEADER];
@@ -85,6 +143,14 @@ const startPreviewProxy = (args) => {
             sendJsonError(res, 400, 'Preview proxy: malformed request URL');
             return;
         }
+        if (pathname === common_1.APP_SDK_EXPLORE_BASE_TABLE_PATH) {
+            answerExploreBaseTable(req, res).catch(() => {
+                if (!res.headersSent) {
+                    sendJsonError(res, 400, 'Preview proxy: invalid explore base-table request');
+                }
+            });
+            return;
+        }
         // Same authority as the deployed app's postMessage bridge: anything
         // the bridge would reject, preview rejects too.
         if (!(0, common_1.isAllowedAppSdkRoute)(method, pathname)) {
@@ -97,11 +163,7 @@ const startPreviewProxy = (args) => {
             sendJsonError(res, 403, `Preview proxy: request targets project ${routeProjectUuid}, but this preview is pinned to ${args.projectUuid}.`);
             return;
         }
-        const headers = filterHeaders(req.headers, DROPPED_REQUEST_HEADERS);
-        headers.authorization = args.authorization;
-        if (args.proxyAuthorization) {
-            headers['proxy-authorization'] = args.proxyAuthorization;
-        }
+        const headers = withUpstreamCredentials(filterHeaders(req.headers, DROPPED_REQUEST_HEADERS));
         // The previewed app fetches the export's fileUrl directly from the
         // local dev page, which carries no instance credentials — ask the
         // backend for a SIGNED URL, same as the deployed app's bridge.

package/dist/vendor/template/vite.config.js

@@ -177,6 +177,32 @@ export default defineConfig(({ mode }) => {
     // so all API traffic must pass through the allowlisted /api proxy.
     // script-src/style-src stay permissive because Vite's dev runtime needs
     // inline + eval, so this is NOT a full stand-in for the deployed sandbox.
+    // Under `lightdash apps preview`, requests go to the CLI's loopback proxy,
+    // which checks the route against the data-app SDK allowlist and attaches
+    // the credential before forwarding to Lightdash. Without the CLI (bare
+    // `npm run dev`) requests go to the instance uncredentialed and fail with
+    // 401 — preview requires the CLI command.
+    const previewProxy = {
+        target: previewProxyTarget || lightdashUrl,
+        changeOrigin: true,
+        secure: true,
+        configure: (proxy) => {
+            if (!previewProxyNonce) return;
+            proxy.on('proxyReq', (proxyReq, req) => {
+                // Do not turn Vite into an unauthenticated front door to the
+                // nonce-protected CLI proxy. The SDK presents the run-scoped
+                // nonce as its local API key; only matching requests receive
+                // the inner proxy header.
+                if (req.headers.authorization === `ApiKey ${previewProxyNonce}`) {
+                    proxyReq.setHeader(
+                        'x-lightdash-preview-nonce',
+                        previewProxyNonce,
+                    );
+                }
+            });
+        },
+    };
+
     const previewCsp = [
         `default-src 'none'`,
         `script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:`,
@@ -207,36 +233,10 @@ export default defineConfig(({ mode }) => {
             cors: false,
             headers: { 'Content-Security-Policy': previewCsp },
             proxy: {
-                '/api': {
-                    // Under `lightdash apps preview`, /api goes to the CLI's
-                    // loopback proxy, which checks the route against the
-                    // data-app SDK allowlist and attaches the credential
-                    // before forwarding to Lightdash. Without the CLI (bare
-                    // `npm run dev`) requests go to the instance uncredentialed
-                    // and fail with 401 — preview requires the CLI command.
-                    target: previewProxyTarget || lightdashUrl,
-                    changeOrigin: true,
-                    secure: true,
-                    configure: (proxy) => {
-                        if (!previewProxyNonce) return;
-                        proxy.on('proxyReq', (proxyReq, req) => {
-                            // Do not turn Vite into an unauthenticated front
-                            // door to the nonce-protected CLI proxy. The SDK
-                            // presents the run-scoped nonce as its local API
-                            // key; only matching requests receive the inner
-                            // proxy header.
-                            if (
-                                req.headers.authorization ===
-                                `ApiKey ${previewProxyNonce}`
-                            ) {
-                                proxyReq.setHeader(
-                                    'x-lightdash-preview-nonce',
-                                    previewProxyNonce,
-                                );
-                            }
-                        });
-                    },
-                },
+                '/api': previewProxy,
+                // SDK virtual routes (e.g. explore base table) are answered
+                // by the CLI proxy itself, never by the instance.
+                '/__sdk': previewProxy,
             },
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightdash/cli",
-  "version": "2.599.0",
+  "version": "2.600.0",
   "description": "Lightdash CLI tool",
   "license": "MIT",
   "repository": {
@@ -22,8 +22,8 @@
     "@actions/core": "1.11.1",
     "@aws-sdk/credential-providers": "3.995.0",
     "@casl/ability": "6.8.0",
-    "@lightdash/common": "2.599.0",
-    "@lightdash/warehouses": "2.599.0",
+    "@lightdash/common": "2.600.0",
+    "@lightdash/warehouses": "2.600.0",
     "@sidvind/better-ajv-errors": "7.0.0",
     "@types/columnify": "1.5.1",
     "ajv": "8.18.0",